PHP2Shell: attackers moved four days before the patch — only PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 closes it
Asked:
"do a good research on the php2shell attack thje cybersecurity text"
This defensive report covers PHP2Shell — CVE-2026-109618 and CVE-2026-109619, two Critical (CVSS v4.0 9.2) unauthenticated remote-code-execution flaws in PHP core disclosed in October 2026. It is built from 15 source-linked rows across 14 hosts, with php.net treated as authoritative for mechanics, scope, fixed versions and mitigations; other sources corroborate. Research is current through 30 October 2026. No exploit code or attack procedures are included.
17–23 October 2026: the defender's clock started before disclosure
Hover or tap a marker for detail. Red: observed attacker activity. Blue: defender milestones. Grey: information events. Hunt window starts 17 October.
The first exploit attempt hit Amazon's MadPot honeypot on 17 October, four days before patches shipped on 21 October at 14:00 UTC; how the actor learned of the embargoed bugs is unknown — it-connect.tech
Highest demonstrated risk is on Apache mod_php, where exploitation can occur during request ingestion, before any application code or application-level defence runs — agilicus.com
Attacks can leave minimal telemetry — often only a memory-limit fatal error — so absence of obvious traces does not establish absence of compromise — 31wedge.com
PHP core developer Gina Peter Banyard called official patches the only permanent defence; the UK NCSC asked organisations to update PHP servers immediately or take them offline — bleepingcomputer.com
What PHP2Shell is, and the high-level attack chain
CVE-2026-109618 — RCE via OOM corruption
Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, so request cleanup may treat invalid data as valid (per php.net). At a high level, an attacker drives a worker toward a memory boundary with an unauthenticated request and abuses the broken state left behind — no account, no application bug required.
CVE-2026-109619 — RCE via stale global state
Request-owned internal state can survive after its backing memory is freed, and a later request handled by the same worker may use the stale state before normal initialization resets it — a use-after-free across requests. Session upload-progress handling is the technically documented primitive across independent write-ups (github.com), with confirmed session paths on mod_php and PHP-FPM (php2shell.io).
Affected scope: PHP says PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. Reports that every version since PHP 5 is affected are not vendor-confirmed and should be treated as provisional. ASEC independently reproduced exploitation ending in command execution as the web account (www-data) — asec.ahnlab.com.
Urgent response: patch, restart every worker, verify
Required
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or deploy a vendor-confirmed complete backport (distribution-bundled builds included).
Restart or replace every PHP worker — Apache, every PHP-FPM pool, long-running workers — then verify the runtime that actually serves the application.
For end-of-life PHP (8.1 and older), obtain a vendor backport or migrate to a supported branch; EOL branches get no fix.
Rotate potentially exposed secrets when compromise cannot be excluded.
Temporary exposure reductions — incomplete by design
PHP states these reduce exposure to specific paths but do not make an installation safe; updating is the only safe choice. They may also affect functionality.
Disable session.upload_progress and restart all workers.
On PHP 8.5, disable fatal_error_backtraces and restart.
Constrain multipart and request sizes at the proxy or web server (low post_max_size; enforce limits for decoded bodies at the edge).
Consider PHP's documented memory-limit and cgroup guidance (e.g. admin-enforced memory_limit=-1 with a container/cgroup boundary).
Detection and hunting — from 17 October, not disclosure
Preserve
Telemetry to keep
Web and proxy logs, PHP logs, EDR, process, filesystem and network telemetry back to at least 17 October 2026.
Low-signal clue
A lone memory-limit fatal error may be the only trace of an attempt.
Hunt
Requests
Suspicious multipart POST activity and session-upload-progress artifacts, including form uploads carrying PHP_SESSION_UPLOAD_PROGRESS.
Behaviour
Unexpected child processes or outbound connections from PHP or web-server workers; unexplained file changes, persistence, credential access and secret exposure.
Qualify
Suspicion vs proof
Request data alone does not prove execution; examine the server's response and host evidence. Honeypot attempts do not prove production compromise.
Compensating controls
Zeek/Suricata indicators and WAF rules (e.g. Corelight's package) can match benign traffic and never substitute for patching.
Strategic lessons
Disclosure is the wrong start for the response clock. Pre-disclosure attempts mean the defender's window can be breached before it officially opens; incident scoping and log retention must assume exploitation before public knowledge.
Runtime bugs bypass application defences. Flaws latent since 2012 fired before application code ran. Isolate legacy web consoles behind authenticated boundaries, restrict unauthenticated POST paths at the proxy, and keep the runtime patchable everywhere it is deployed.
Evidence: all 15 source-linked rows
Section
Source · date
Finding
Defensive action / caveat
Link
Method: 15 source-linked rows from 14 hosts on the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619), research current through 30 October 2026. php.net is treated as authoritative for mechanics, scope, fixed versions and mitigations; other sources are corroboration, and secondary or unconfirmed claims are labelled. Timeline dates come from source reporting; findings and actions are truncated in the table for space — follow each link for the full text. No exploit code or offensive detail is included.